CVE-2025-0511

High

Published: 12 February 2025

Published

12 February 2025

Modified

20 February 2025

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0090 75.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0511 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Welcart Welcart E-Commerce. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked in the top 24.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Browser Session Hijacking (T1185) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 requires validation of inputs like the 'name' parameter to prevent injection of malicious scripts due to insufficient sanitization.

SI-15 Information Output Filtering good match

prevent

SI-15 mandates output filtering and escaping to block execution of injected scripts when pages are accessed.

SI-2 Flaw Remediation good match

preventrecover

SI-2 ensures timely flaw remediation by patching the vulnerable Welcart plugin versions up to 2.11.9.

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1491.002 External Defacement Impact

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

attack.mitre.org →

T1528 Steal Application Access Token Credential Access

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

attack.mitre.org →

Why these techniques?

Stored XSS directly enables browser script execution for session hijacking (T1185), external defacement (T1491.002), and stealing web/app tokens or cookies (T1528).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…

inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Deeper analysisAI

CVE-2025-0511 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the Welcart e-Commerce plugin for WordPress. It affects all versions up to and including 2.11.9 due to insufficient input sanitization and output escaping of the 'name' parameter. Published on 2025-02-12, the flaw has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity with network accessibility, low complexity, no privileges or user interaction required, and scope change.

Unauthenticated attackers can exploit this vulnerability to inject arbitrary web scripts into pages via the 'name' parameter. The injected scripts execute in the context of any user accessing the affected page, enabling potential theft of administrator credentials, session hijacking, or site defacement.

Mitigation details are available in referenced advisories and patches, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/6c26270b-a0a7-4877-aa66-bffe260003df?source=cve, the patch changeset at https://plugins.trac.wordpress.org/changeset/3235131/, and vulnerable code in https://plugins.trac.wordpress.org/browser/usc-e-shop/trunk/functions/settlement_func.php#L612. Security practitioners should review the plugin's developer page at https://wordpress.org/plugins/usc-e-shop/#developers for updated versions beyond 2.11.9.